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(57) Abstract: A safety redundant drive by wire system (10) includes a plurality of first control members (12) to which control 
signals may be communicated and a plurality of device controllers (16) adapted to deliver control signals to a respective first control 
member (12). At least one sensor is coupled to each first control member (12) for sensing a parameter of the first control memt>er 
(12) and responsivdy generating a sensor signal. Each device controller includes a first microprocessor for communicating control 
signals to the first control member ( 1 2) and all other device controllers. 
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ELECTRIC CALIPER HARDWARE TOPOLOGIES FOR A SAFETY 

SYSTEM 

5 BACKGROUND OF THE INVENTION 

1 . Field of the Invention 
The subject invention relates to a system for controlling brake motors or 
steering motors on a vehicle. More particularly, this invention relates to a system for 
redundantly controlling brake motors and steering motors on a vehicle having a brake 
10 by wire or drive by wire system. 



2. Description of the Prior Art 
Brake by wire and drive by wire systems are known in the prior art whereby 
one can control the steering and braking functions of a vehicle using a control device, 
15 such as a steering wheel and brake pedal or joystick. Typically, these systems have 
more than one communication channel for communicating signals from the control 
device to the steering and braking motors such that, when that communication channel 
experiences an error, the entire system is not inoperable. 

Control systems with redundant communications networks are typically 
20 accomplished using two different families of device controllers, wherein each family 
of device controllers operates independently on two separate networks. These 
redundant systems require a significant amount of hardware, which are difficult and 
expensive to package in a vehicle with a drive by wire or brake by wire system. 
It is desirable to provide redundancy in a brake by wire or drive by wire 

25 system. 
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SUMMARY OF THE INVENTION AND ADVANTAGES 
The invention provides a safety redundant drive by wire system comprising a 
plurality of brake motors disposed in comers of a vehicle to which control signals may 
be communicated. A plurality of sensors are disposed in the system, such that at least 
5 one sensor is coupled to the brake motor for sensing a parameter of the brake motor and 
responsively generating a sensor signal. A device controller is disposed in the comers 
of the vehicle and adapted to deliver control signals to a respective brake motor. Each of 
the device controllers includes a first and second microprocessor for communicating 
control signals to the brake motor associated with that device controller, all other device 
10 controllers and each other. Each device controller is adapted to receive the sensor signal 
and provide it to the first and second microprocessors. 

The control signals are communicated over a dual redundant communication 
channel system having a first communication channel for communicating control signals 
firom one device controller to all other device controllers, and a second communication 
15 channel for redundantly communicating control signals between device controllers. The 
first and second microprocessors control the first and second communication channels, 
respectively. 

A plurality of hardware configurations which may be used independently or 
together in some combination to achieve redundant drive by wire and brake by wire 
20 systems. Accordingly, the first and second microprocessors on a device controller 
control the first and second communication channels, respectively, providing a 
redundant drive by wire and brake by wire system with minimal hardware. 

BRIEF DESCRIPTION OF THE DRAWINGS 
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Other advantages of the present invention will be readily appreciated as the same 
becomes better understood by reference to the following detailed description when 
considered in connection with the accompanying drawings wherein: 
5 Figure 1 is a block diagram of a system configuration wherein the first 

microprocessor of each device controller controls a first control member and the second 
microprocessor of each device controller provides redundant communications; 

Figure 2 is a block diagram of a system configuration wherein the first 
microprocessor of each device controller controls a first control member and provides 
10 redundant communications, and the second microprocessor of each device controller 
controls a second control member and provides redundant communications; and 

Figure 3 is a block diagram of a system configuration wherein the first 
microprocessor of two different device controllers control a first control member, and the 
second microprocessor of each device controller provides redundant communications. 

15 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 

Referring to Figures 1 through 3, wherein like numerals indicate like or 
corresponding parts throughout the several views, a safety redundant drive by wire 
20 system is generally shown at 10. In a first embodiment, a plurality of first control 
members 12, such as brake motors, to which control signals may be communicated, are 
disposed in a vehicle 30, one at each wheel. A pluraUty of sensors 14 are disposed within 
the vehicle 30, wherein at least one of the sensors 14 is coupled to each of the first control 
members 12 for sensing a parameter of the first control member 12 and responsively 
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generating a sensor signal. A plurality of device controllers 16, are disposed in the 
vehicle 30, one at each wheel and paired with a brake motor 12, wherein each device 
controller 16 is adapted to deliver control signals to its respective first control member 
12. 

5 Each device controller 16 includes a first microprocessor 1 8, for communicating 

control signals to the first control member 12, thus, providing functionality to the brake 
motor 12, and all other device controllers 16. Each device controller 16 further includes 
a second microprocessor 20 for redundantly communicating control signals to all other 
device controllers 16 and for communicating with the first microprocessor 18. Each 
10 device controller 16 is adapted to receive sensor signals and provide these sensor signals 
to the first and second microprocessors 18, 20. If a device controller 16 detects an error, 
the first microprocessor 18 discontinues controlling the control member 12 and the 
second microprocessor 20 communicates a default control signal to all other device 
controllers 16. 

15 The system of the subject invention further includes a dual redundant 

communication channel system using a time deterministic protocol, such as the Time 
Triggered Protocol (TTP). The dual redundant communication channel has a first 
communication channel 24, for communicating control signals from one device controller 
16 to all other device controllers 16, and a second communication channel 26, for 

20 redundantly communicating control signals from one device controller 16 to all other 
device controllers 16. The first microprocessor 1 8 of each device controller 16 controls 
the first communication channel 24, and the second microprocessor 20 of each device 
controller 16 controls the second communication channel 26. The first 18 and second 
20 microprocessors are synchronized. 
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In one embodiment, the first microprocessor 1 8 and the second microprocessor 
20 are not of identical type. For example, the first microprocessor 1 8 is an MPC555 
microprocessor and the second microprocessor 20 is an HC12 microprocessor. Two 
different microprocessors ensure that identical code is not executed between the control 
5 microprocessors 18. 

In the drive by wire or brake by wire systems of the present invention, the signal 
inputs are generated by a driver operated source such as steering wheel and brake pedal 
and/or a joystick. The device controllers 16 receive the signal input, generate control 
signals and communicate these control signals to the control members 12 associated with 

1 0 the particular device controller 16. 

In a second embodiment of the subject invention, as shown in Figure 3, two 
device controllers 16 are adapted to deliver different control signals to one first control 
member 12, more particularly, a dual wound motor disposed at each front wheel of a 
vehicle. Each device controller 16 operates independently, such that if one device 

15 controller 16 with associated control members 12 fails, the second device controller 16 
can provide some limited control level. In this configuration, one front and one rear 
brake are controlled by the same device controller. This embodiment further includes a 
master microprocessor for controlling the braking functions for the dual wound motor 
controller and a brush motor controller, such that two or more microprocessors are 

20 present in the system to provide either redundant communications or redundant control, 
or both. 

In a third embodiment, the system 10 of the first embodiment includes a second 
control member 34, such as a steering member, to which control signals are 
communicated by the second microprocessor 20 of an associated device controller 16. 
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Each device controller 16 includes a first microprocessor 18, for communicating control 
signals to the first control member 12, thus, providing fimctionality to the brake motor 
12 and all other device controllers 16. The first microprocessor 18 also redundantly 
communicates control signals fi-om the second control member 34 to all other device 
5 controllers 16. Each device controller 16 further includes a second microprocessor 20 for 
conmiunicating control signals to the second control member 34, thus, providing 
functionality to the steering motor, and all other device controllers 16. The second 
microprocessor 20 also redundantly communicates control signals to all other device 
controllers 16 and communicates with the first microprocessor 18. If a device controller 

10 16 detects an error, the first microprocessor 1 8 discontinues controlling the first control 
member 12, while still providing redundant communications for the second 
communication channel 26. The second microprocessor 20 communicates a default 
control signal for the first control member 12 to all other device controllers 16 while still 
communicating control signals to the second control member 34. 

15 In another embodiment, the first microprocessor 18 and the second 

microprocessor 20 are of identical type. For example, both the first microprocessor 18 
and the second microprocessor 20 are MPC555 microprocessors. While two identical 
microprocessors allow propagation of software bugs, software development is simplified. 
In yet another embodiment of the system 10, the first microprocessor 18 of one 

20 of the device controllers 16 commimicates control signals to the second control member 
34. 

With reference to Fig. 4, the present invention is applied to a braking and steering 
system 40 having a first road wheel (RW) dual wound motor 42, a second road wheel 
dual mount motor 44, a left fi-ont (LF) brake motor 46, a right fi-ont (RF) brake motor 48, 
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a left rear (LR) brake motor 50, and a right rear (RR) brake motor 52. The first and 
second RW dual wound motors 42, 44 for providing steering control to a vehicle (not 
shown). The LF, RF, LR, and RR motors provide braking control for the vehicle. 

A first RW steering dual microprocessor controller 54 controls actuation of the 
5 first RW dual wound motor 42. A second RW steering dual microprocessor controller 
56 controls actuation of the second RW dual wound motor 44. 

A LF brake dual microprocessor controller 58 controls actuation of the LF brake 
motor 46. A RF brake dual microprocessor controller 60 controls actuation of the RF 
brake motor 48. A LR brake dual microprocessor controller 62 controls actuation of the 
1 0 LR brake motor 50. A RR brake dual microprocessor controller 64 controls actuation of 
the RR brake motor 52. Preferably, the LR controller 62 and the RR controller 64 each 
control one of two hand wheel steering motors 66. 

The dual microprocessor controllers 54,56,58,60,62,64 each have first and second 
microprocessors 18, 20, as described above. In one embodiment, the first and second 
15 microprocessors 18,20 of the first and second RW steering dual microprocessor 
controllers 54, 56 each control one half of the respective dual would motor 42,44. Thus, 
if one the first and second microprocessors 18,20 fails or is taken off-line due to a fault 
then steering fiinction exists through the other microprocessor 18,20. 

With reference to Fig. 5, an alternative embodiment 70 of the braking and 
20 steering system 40 is shown. In Fig. 5, like elements are numbered the same as in Fig. 
4. The first RW steering dual microprocessor 54 and the LF brake dual microprocessor 
controller 58 are combined in a first brake and steer dual microprocessor controller 72. 
The second RW steering dual microprocessor 56 and the RF brake dual microprocessor 
controller 60 are combined in a second brake and steer dual microprocessor 74. 
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With reference to Fig. 6, a system 80 is illustrated where a dual wound motor 82 
controls a single function, such as braking and/or steering. The system 80 includes a 
main controller 84, a first motor controller 86, and a second motor controller 88. The 
main controller 84, first motor controller 86 and the second motor controller 88 each 
5 include a single microprocessor 18, 20 which performs operational checks on the other 
controllers 84,86,88. Under normal operation, the main controller 84 provides control 
information to the first and second motor controllers 86,88. The first and second motor 
controllers 86,88 each control one half of the dual wound motor 82. The main controller 
84,86,88 are coupled to a common bus 90 for sharing all inputs and outputs such that 
10 each controller 84,86,88 can operation independently at a low power output. 

Obviously, many modifications and variations of the present invention are 
possible in light of the above teachings. The invention may be practiced otherwise than 
as specifically described within the scope of the appended claims, wherein that which is 
prior art is antecedent to the novelty set forth in the "characterized by" clause. The 
1 5 novelty is meant to be particularly and distinctly recited in the "characterized by" clause 
whereas the antecedent recitations merely set forth the old and well-known combination 
in which the invention resides. These antecedent recitations should be interpreted to 
cover any combination in which the incentive novelty has utility. In addition, the 
reference numerals in the claims are merely for convenience and are not to be read in any 
20 way as limiting. 
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CLAIMS 

What is claimed is: 

1 . A safety redundant drive by wire control system (10) comprising: 

a plurality of first control members (12) to which control signals may be 
5 communicated; 

a plurality of sensors (14), wherein at least one of said sensors (14) is 
coupled to each of said first control members (12) for sensing a parameter of said 
first control members (12) and responsively generating a sensor signal; 

a plurality of device controllers (16), each of said device controllers (16) 
10 is adapted to deliver control signals to a respective first control member (12), 

wherein each of said device controllers (16) includes 

a first microprocessor (18) for communicating control signals to said first 
control member (12) and all other device controllers (16), and 

a second microprocessor (20) for communicating control signals to said 
15 all other device controllers (16) and for communicating with said first 

microprocessor (1 8), 

wherein each said of device controllers (16) is adapted to receive said 
sensor signal and provide said sensor signal to said first (18) and second (20) 
microprocessors; 

20 a dual redundant communication chaimel system having a first 

communication channel (24) for communicating control signals fi'om one of said 
device controllers (16) to said all other device controllers (16), and a second 
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communication channel (26) for redundantly communicating control signals from 
one of said device controllers (16) to said all other device controllers (16); 

wherein said first microprocessor (18) of said device controllers (16) 
controls said first communication channel (24), and said second microprocessor 
5 (20) controls said second communication channel (26). 

2. The system (10) of claim 1, wherein two of said device controllers (16) are 
adapted to deliver control signals to one of said first control members (12). 

10 3. The system (1 0) of claim 1 including a second control member (34) to which 

control signals may be communicated. 

4. The system (10) of claim 3, wherein one of said device controllers (16) is 
adapted to deliver control signals to said second control member (34). 

15 

5. The system (10) of claim 4, wherein said second microprocessor (20) of said 
one of said device controllers (16) communicates control signals to said second control 
member (34). 

20 6. The system (10) of claim 4, wherein said first microprocessor (1 8) of one said 

of said device controllers (16) communicates control signals to said second control 
member (34). 
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7. The system (10) of claim 1, wherein said first microprocessor (18) and said 
second microprocessor (20) are synchronized, 

8. The system (10) of claim 1, wherein said system (10) is disposed in a vehicle 
having a plurality of comers, wherein one of said first control members (12) is disposed 
in each of said comers. 

9. The system (10) of claim 1, wherein said first control member (12) is a brake 

motor. 

10. The system (10) of claim 8, including a second control member (34) to which 
control signals may communicated. 

11. The system (10) of claim 10, wherein said second control member (34) is a 
1 5 steering motor. 

12. The system (10) of claim 1, wherein said first microprocessor (18) and said 
second microprocessor (20) are of identical type. 

20 13. The system (10) of claim 1, wherein said first microprocessor (18) and said 

second microprocessor (20) are of different type. 



5 



10 
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14. A vehicle (30) having a drive by wire control system (10) comprising: 
a plurality of brake members (12) disposed in said vehicle (30); 
a plurality of device controllers (16) for controUably actuating said brake 
members (12), and said device controllers (16) being connected by a redundant 
S communication system wherein said redundant communication system includes; 

a first communication channel (24) wherein said first communication 
channel (24) is adapted to communicate control signals to at least one other device 
controller (16); and 

a second communication channel (26) for providing redundant 
10 communication of said first communication channel (24); 

wherein each of said device controllers (16) controllably actuates one of said 
brake members (12). 



15. The vehicle (30) of claim 14, including a steering member ((34) disposed in 
15 said vehicle (30), wherein one of said device controllers (16) controllably actuates said 
steering member (34). 



16. The vehicle (30) of claim 15, wherein said device controllers (16) control said 
first communication channel (24) and said second communication channel (26). 

20 

1 7. The vehicle (30) of claim 1 6 including a driver operated source for generating 
a signal input. 



BNSDOCID: <WO 014477BA1_L> 



wo 01/44778 



PCT/USOO/33796 



13 



1 8. The vehicle (30) of claim 17, wherein said device controllers (16) are adapted 
to generate control signals as a function of said signal input and deliver said control 
signals to said brake members (12). 

5 

19. A vehicle (30) having a drive by wire control system (10) comprising: 

a plurality of steering members (34) disposed in said vehicle (30); 
a plurality of device controllers (16) for controllably actuating said 
steering members (34), and said device controllers (16) being connected by a redundant 
10 communication system; 

a first communication channel (24); and 
a second communication channel (26); 
wherein one of said device controllers (16) controllably actuates one of said 
steering members (34). 
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